Which IPsec protocol provides integrity and data origin authentication with optional anti-replay?

Which IPsec protocol provides integrity and data origin authentication with optional anti-replay?

• A. ESP
• B. AH
• C. IKE
• D. IDS

Answer: (B)

AH, the Authentication Header, provides integrity and data origin authentication for IP packets and can offer anti-replay protection. It authenticates the entire IP packet (excluding only mutable fields) using a cryptographic value, ensuring the packet hasn’t been tampered with and that it came from the claimed sender. The anti-replay feature uses a sequence number within the Security Association, allowing the receiver to detect duplicates or out-of-order packets by maintaining a sliding window. Importantly, AH does not provide confidentiality, so it does not encrypt payload data. ESP, by contrast, focuses on confidentiality (with optional integrity for the payload) and does not authenticate the IP header in the same way; IKE handles key management, and IDS is not part of IPsec.

AH, the Authentication Header, provides integrity and data origin authentication for IP packets and can offer anti-replay protection. It authenticates the entire IP packet (excluding only mutable fields) using a cryptographic value, ensuring the packet hasn’t been tampered with and that it came from the claimed sender. The anti-replay feature uses a sequence number within the Security Association, allowing the receiver to detect duplicates or out-of-order packets by maintaining a sliding window. Importantly, AH does not provide confidentiality, so it does not encrypt payload data. ESP, by contrast, focuses on confidentiality (with optional integrity for the payload) and does not authenticate the IP header in the same way; IKE handles key management, and IDS is not part of IPsec.